Using TraceForge

TraceForge offers two operational workflows:

Interactive TTY Console: Menu-driven interface for human investigators.
Direct CLI Subcommands: Scriptable commands for pipelines, incident response playbooks, and terminal workflows.

1. Interactive TTY Console

To launch the interactive console:

traceforge
# or
./main.sh

╔══════════════════════════════════════════════════════════════════════╗
║                             TRACEFORGE                               ║
║           Open-Source Intelligence & Digital Forensics               ║
╠══════════════════════════════════════════════════════════════════════╣
║ Lead: Aman Kumar Pandey    Profile: PYTHON-GO    Platform: Workstation ║
╚══════════════════════════════════════════════════════════════════════╝

======================================================================
  TRACEFORGE — Interactive Operator Console
  [Active Case: None (Default Workspace)] • [Profile: PYTHON-GO]
======================================================================
  [1] New Case                 (Initialize a new forensic case)
  [2] Open Case                (Switch active case)
  [3] List Cases               (View all registered workspaces)
  [4] Add Evidence             (Ingest evidence with SHA-256 integrity hash)
  [5] Run Investigation        (Execute one of 7 analysis modules)
  [6] TraceForge Tools         (Run native first-party analytical tools)
  [7] Tool Catalog             (Search, inspect, and audit 152 tools)
  [8] Export / Reports         (Generate Markdown, HTML, CSV, STIX, MISP)
  [S] Settings                 (Configure runtime profile & fast-paths)
  [D] Doctor                   (Check environment, dependencies & runtimes)
  [L] Legal / Policy           (Responsible use, disclaimers, privacy)
  [Q] Quit

Keyboard Shortcuts:

1 - 8: Select case management, evidence ingestion, module execution, or report export.
S: Open runtime settings to change active profile or configure fast-path overrides.
D: Run environment doctor diagnostics.
L: Display responsible use, legal disclaimers, and statutory policies.
Q: Exit cleanly.

2. Direct CLI Subcommands

For headless servers, CI/CD pipelines, and script automation, every action is available directly on the command line:

# Doctor diagnostics
traceforge doctor

# Case management
traceforge case new "Case-Alpha" --analyst "Aman"
traceforge case list
traceforge case open CASE-20260825-A1B2C3
traceforge case add-evidence ./dump.raw --desc "RAM image"

# Investigation modules
traceforge module 1 ./photo.jpg                # Image forensics
traceforge module 2 ./traffic.pcap             # Network recon
traceforge module 3 target_handle              # Identity & social
traceforge module 4 target@example.com         # Email breach
traceforge module 5 example.com                # Domain & DNS
traceforge module 6 ./report.pdf               # Document harvesting
traceforge module 7                            # OPSEC audit

# First-party analytical tools
traceforge tools asset-graph ./domains.txt --html ./graph.html
traceforge tools diff old_dns.txt new_dns.txt --domain dns
traceforge tools ioc-extract ./logs.txt --defang
traceforge tools evidence-index /evidence/directory/
traceforge tools log-triage ./access.log
traceforge tools pcap-summary ./capture.pcap
traceforge tools file-baseline /etc/ --out baseline.json
traceforge tools endpoint-inspect

# Tool catalog search
traceforge catalog "metadata"

# Export deliverables
traceforge export --redact --out ./deliverables/